WAPT WUA level questions

[ddcorazon]

Hello everyone,

I have a few questions regarding WAPT

I have been using WAPT for some time on my network and I am starting to migrate all my machines to it.

Regarding Windows Updates: can upgrades from version 23H2 to 24H2 be done using the standard method, or do I need to use the tis-windows11-upgrade-template package with an up-to-date ISO? I'm asking because I have PCs running 22H2 or 21H2 on which, despite running updates, they perform the standard cumulative updates but never upgrade to the correct version.
- What I do every second Wednesday of the month: I right-click, then select "Search for Windows Updates," then right-click again and select "Download," and finally right-click again and select "Install." I leave about 30 minutes between each step unless I need to do otherwise

manual.png (22.98 KB) Viewed 5986 times

The second question concerns WAPTWUA. Once activated on the server, I understand that it disables access to Windows Update on the client. However, internally, for some PCs, I need (a bit of a pain, I know) for users to be able to launch updates manually on their workstations. So, the question is, can we do both in case people forget to launch them? Or is it either WAPTWUA or manual updates?

And one last question: `tis-enable-windows-update` is supposed to allow manual updates to be reactivated on PCs; the package is installed and the wuauserv service is running correctly, but the "check for updates" button remains greyed out

serv1.png (163.69 KB) Viewed 5986 times

reg2.png (231.91 KB) Viewed 5986 times

WAPT Server version: 2.6.0.16613 Ubuntu 20.04
WAPT Agent version: 2.6.0.16613

[ddcorazon]

In response,

Regarding the tis-enable-windows-update package, I modified it slightly. I added a few extra registry keys.

I added SetDisableUXWUAccess to set it to 0, and DODownloadMode to also set it to 0. It seems to be OK.

Code: Select all

def install():
  print('Disable WAPT WUA')
  inifile_writestring(WAPT.config_filename,'waptwua','enabled','false')

  print('DisableWindowsUpdateAccess registry to 0')
  registry_set(HKEY_LOCAL_MACHINE,r'Software\Policies\Microsoft\Windows\WindowsUpdate','DisableWindowsUpdateAccess',0,REG_DWORD)

  print('SetDisableUXWUAccess registry to 0')
  registry_set(HKEY_LOCAL_MACHINE,r'Software\Policies\Microsoft\Windows\WindowsUpdate','SetDisableUXWUAccess',0,REG_DWORD)

  print('AUOptions registry to 0')
  registry_set(HKEY_LOCAL_MACHINE,r'SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update','AUOptions',0,REG_DWORD)

  print('DODownloadMode registry to 0')
  registry_set(HKEY_LOCAL_MACHINE,r'SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization','DODownloadMode',0,REG_DWORD)

  print('DODownloadMode registry to 0')
  registry_set(HKEY_LOCAL_MACHINE,r'SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config','DODownloadMode',0,REG_DWORD)

  print('Setting WUA')
  wuasettings = "False"
  inifile_writestring(WAPT.config_filename,'default_waptwua','enabled',wuasettings)

  print('Enable wuauserv')
  run_notfatal('sc config wuauserv start= auto')
  run_notfatal('net start wuauserv')

  print('Reload WAPT configuration')
  WAPT.reload_config_if_updated()

However, there are still no answers regarding version upgrades. Does anyone have any ideas?

Thank you in advance

[blemoigne]

Hello,
WAPTWUA uses this method:
https://learn.microsoft.com/fr-fr/windo ... powershell
Indeed, only minor updates are included in the wsusscn2.cab index used. Therefore, you will need to use the WAPT upgrade packages for major updates.
You can let users launch the updates by running "C:\Program Files (x86)\wapt\waptexit.exe" (you can create a shortcut on the desktop, for example).
For more information regarding the configuration of agents for Windows updates: https://www.wapt.fr/fr/doc/wapt-console ... wapt-agent

Have a good day,
Bertrand

[ddcorazon]

Hello,

thank you for your feedback and have a great day!